Re: NDIS WAN IM for WinCE

patrick_at_klos.com
Date: 06/24/04

  • Next message: Steve Maillet \(eMVP\): "Re: Connect file system to a desktop PC to see device files in PC explorer" 
    Date: 24 Jun 2004 16:31:56 GMT

    In article <e544e0f9.0406240728.595d9e10@posting.google.com>,
    John Walker <john_walker2020@yahoo.com> wrote:
    >Hello Patcik,
    >
    >Here are some of the dumps of the packets when my Ndis IM Wan driver
    >Send handler is called.
    >
    >Please note. I only printed out a hex dump of the first 20 bytes of
    >each packet.

    We really need the rest of the packets to break it apart for you.

    >This is the virtual address of the Current Buffer for the
    >NDIS_WAN_PACKET
    >ff 03 c0 21 01 01 00 0e 02 06 ...!......

    LCP Configure-Request

    >ff 03 c0 21 02 01 00 0e 02 06 ...!......

    LCP Configure-Ack

    >80 21 01 01 00 28 02 06 00 2d .!...(...-

    IPCP Configure-Request (note that the address and contro field [ff 03]
    has been "compressed" out).

    >80 fd 01 01 00 0a 12 06 00 00 ..........

    CCP (Compression Control Protocol) Configure-Request

    >80 21 02 01 00 10 02 06 00 2d .!.......-

    IPCP Configure-Ack

    >80 fd 02 01 00 0a 12 06 00 00 ..........

    CCP Configure-Ack

    >80 21 01 02 00 28 02 06 00 2d .!...(...-

    (another) IPCP Configure-Request

    >fd 60 00 00 21 45 00 00 40 f0 .`..!E..@.

    Compressed packets. Once CCP is negotiated, the peer will start
    sending all compressible packets this way. Note that the address
    and control field are gone (as before), and the protocol ID of 00 fd
    has been "compressed" as it can be represented by a single byte.

    >This is the virtual address of the Start Buffer for the
    >NDIS_WAN_PACKET
    >
    >00 00 00 00 00 00 00 00 00 00 ..........
    >7e ff 7d 23 c0 21 7d 21 7d 21 ~.}#.!}!}!

    Note how these include the escape characters - this is how the
    packet appears on the wire.

    >>From looking at this. I can see the starting Flag(7E) for the Start
    >Buffer. But the other data there after is confusing because they are
    >not consistent with what I am expecting for a PPP packet.

    Give us 1 or 2 whole PPP packets and we'll disect them so you can
    see what's where.

    >Is the starting FD in the packet buffer an indication that it is using
    >MPPC protocol as Jeff suggested?

    Yes.

    >Thanks for your assistance guys

    Whatever happened to the TV commercial with the line "You're a dad - it's
    your job!"?? ;^)

    Patrick
    ========= For LAN/WAN Protocol Analysis, check out PacketView Pro! =========
        Patrick Klos Email: patrick@klos.com
        Klos Technologies, Inc. Web: http://www.klos.com/
    ==================== What goes around, comes around... =====================

  • Next message: Steve Maillet \(eMVP\): "Re: Connect file system to a desktop PC to see device files in PC explorer"

    Relevant Pages